Skip to content

GitLab

T
tangled
Commit e754b45b authored by morrita@chromium.org's avatar morrita@chromium.org
Browse files
Options

[import] Use master document's origin to resolve CORS 

This follows the spec change on https://www.w3.org/Bugs/Public/show_bug.cgi?id=24905
where the fetch origin is given by the master document, not the referring document.
This matches what CSP in imports is doing: Using master's CSP directive to regulate
all the imports.

In implemntation, it just set ResourceLoaderOptions::m_securityOrigin in
FetchRequest::setCrossOriginAccessControl() because HTMLImportsController
happened to pass the master' origin already.
(That was wrong but wasn't covered by the test.)

This change doesn't affect other FetchRequest client because in other callsite,
m_securityOrigin is same as one that is used when it is absent.

TEST=cors-same-origin.html
BUG=348671
R=abarth@chromium.org, dglazkov@chromium.org

Review URL: https://codereview.chromium.org/186803005

git-svn-id: svn://svn.chromium.org/blink/trunk@168497 bbb929c8-8fbe-4397-9dbb-9b2b20218538
parent b16e70a4
Hide whitespace changes
Inline Side-by-side
Showing with 33 additions and 8 deletions
third_party/WebKit/LayoutTests/http/tests/htmlimports/cors-same-origin-expected.txt
View file @ e754b45b
PASS target.import.querySelector('h1').innerHTML is 'Hello, CORS!' CONSOLE ERROR: Imported resource from origin 'http://localhost:8080' has been blocked from loading by Cross-Origin Resource Sharing policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://127.0.0.1:8000' is therefore not allowed access.
PASS basic.import.querySelector('h1').innerHTML is "Hello, CORS!"
PASS nested.import.querySelector('#sameOriginNoCors').import is null
PASS nested.import.querySelector('#sameOriginCors').import.querySelector('h1').innerHTML is "Hello, CORS!"
PASS nested.import.querySelector('#masterOriginNoCors').import.querySelector('h1').innerHTML is "Hello"
PASS nested.import.querySelector('#masterOriginCors').import.querySelector('h1').innerHTML is "Hello, CORS!"
PASS successfullyParsed is true PASS successfullyParsed is true
TEST COMPLETE TEST COMPLETE
......
third_party/WebKit/LayoutTests/http/tests/htmlimports/cors-same-origin.html
View file @ e754b45b
<!DOCTYPE html> <!DOCTYPE html>
<html> <html>
<head> <head>
<link id="target" rel="import" href="http://localhost:8080/htmlimports/resources/cors-basic.cgi"> <link id="basic" rel="import" href="http://localhost:8080/htmlimports/resources/cors-basic.cgi">
<link id="nested" rel="import" href="http://localhost:8080/htmlimports/resources/cors-subimports.cgi">
<script src="/js-test-resources/js-test.js"></script> <script src="/js-test-resources/js-test.js"></script>
</head> </head>
<body> <body>
<script> <script>
shouldBe("target.import.querySelector('h1').innerHTML", "'Hello, CORS!'");
shouldBeEqualToString("basic.import.querySelector('h1').innerHTML", "Hello, CORS!");
shouldBeNull("nested.import.querySelector('#sameOriginNoCors').import");
shouldBeEqualToString("nested.import.querySelector('#sameOriginCors').import.querySelector('h1').innerHTML", "Hello, CORS!");
shouldBeEqualToString("nested.import.querySelector('#masterOriginNoCors').import.querySelector('h1').innerHTML", "Hello");
shouldBeEqualToString("nested.import.querySelector('#masterOriginCors').import.querySelector('h1').innerHTML", "Hello, CORS!");
</script> </script>
</body> </body>
</html> </html>
third_party/WebKit/LayoutTests/http/tests/htmlimports/resources/child-having-domain-policy.cgi
View file @ e754b45b
...@@ -9,7 +9,7 @@ print <<EOF ...@@ -9,7 +9,7 @@ print <<EOF
<!DOCTYPE html> <!DOCTYPE html>
<html> <html>
<head> <head>
<link rel="import" href="having-domain-policy.html"> <link rel="import" href="having-domain-policy.cgi">
</head> </head>
</html> </html>
EOF EOF
third_party/WebKit/LayoutTests/http/tests/htmlimports/resources/cors-basic.cgi
View file @ e754b45b
...@@ -6,4 +6,3 @@ print "Access-Control-Allow-Credentials: true\n"; ...@@ -6,4 +6,3 @@ print "Access-Control-Allow-Credentials: true\n";
print "Access-Control-Allow-Origin: http://127.0.0.1:8000\n\n"; print "Access-Control-Allow-Origin: http://127.0.0.1:8000\n\n";
print "<html><body><h1>Hello, CORS!</h1></body></html>\n"; print "<html><body><h1>Hello, CORS!</h1></body></html>\n";
third_party/WebKit/LayoutTests/http/tests/htmlimports/resources/cors-subimports.cgi 0 → 100755
View file @ e754b45b
#!/usr/bin/perl -wT
use strict;
print "Content-Type: text/html\n";
print "Access-Control-Allow-Credentials: true\n";
print "Access-Control-Allow-Origin: http://127.0.0.1:8000\n\n";
print <<EOF
<!DOCTYPE html>
<link id="sameOriginCors" rel="import" href="cors-basic.cgi?1">
<link id="sameOriginNoCors" rel="import" href="resources/hello.html?1">
<link id="masterOriginNoCors" rel="import" href="http://127.0.0.1:8000/htmlimports/resources/hello.html?2">
<link id="masterOriginCors" rel="import" href="http://127.0.0.1:8000/htmlimports/resources/cors-basic.cgi?2">
EOF
third_party/WebKit/Source/core/fetch/FetchRequest.cpp
View file @ e754b45b
...@@ -73,13 +73,12 @@ void FetchRequest::setCrossOriginAccessControl(SecurityOrigin* origin, StoredCre ...@@ -73,13 +73,12 @@ void FetchRequest::setCrossOriginAccessControl(SecurityOrigin* origin, StoredCre
{ {
updateRequestForAccessControl(m_resourceRequest, origin, allowCredentials); updateRequestForAccessControl(m_resourceRequest, origin, allowCredentials);
m_options.corsEnabled = IsCORSEnabled; m_options.corsEnabled = IsCORSEnabled;
m_options.securityOrigin = origin;
} }
void FetchRequest::setCrossOriginAccessControl(SecurityOrigin* origin, const AtomicString& crossOriginMode) void FetchRequest::setCrossOriginAccessControl(SecurityOrigin* origin, const AtomicString& crossOriginMode)
{ {
StoredCredentials allowCredentials = equalIgnoringCase(crossOriginMode, "use-credentials") ? AllowStoredCredentials : DoNotAllowStoredCredentials; setCrossOriginAccessControl(origin, equalIgnoringCase(crossOriginMode, "use-credentials") ? AllowStoredCredentials : DoNotAllowStoredCredentials);
updateRequestForAccessControl(m_resourceRequest, origin, allowCredentials);
m_options.corsEnabled = IsCORSEnabled;
} }
} // namespace WebCore } // namespace WebCore
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment